GoSerpent Backdoor Looted Police and Biometric Data Across Southeast Asia for Five Years

For at least five years, a sophisticated espionage operation quietly worked its way through Southeast Asian government networks, harvesting police complaint files, biometric databases, and diplomatic records without triggering a single public alarm. Kaspersky's Global Research and Analysis Team (GReAT) disclosed the campaign on Thursday, publishing a full technical breakdown of the toolchain behind it — a Go-based backdoor named GoSerpent and a suite of purpose-built tools for stealthy collection and exfiltration.

What makes the campaign technically notable is how the final data transfer happened: it looked like an authorized employee accessing a file — because the attackers used credentials stolen months earlier to do exactly that. Standard network monitoring tools, which flag unusual external connections but treat authenticated internal traffic as benign, had nothing to catch.

The research was authored by Noushin Shabab , Lead Security Researcher at Kaspersky GReAT, who described the group's patience as a deliberate operational choice. "Usually, attackers want to move quickly once they get a foothold, but this group drops the initial backdoor and waits," Shabab said. "They let the dust settle for weeks before deploying their secondary exfiltration tools like TmcLoader. That kind of patience is a calculated move designed to outlast standard log retention policies and automated security sweeps, making it incredibly difficult for defenders to connect the initial infection to the eventual data theft."

GoSerpent is a remote access Trojan (RAT) written in Go — a language choice that signals investment in the toolchain, since Go compiles to self-contained cross-platform binaries that do not require a runtime environment on the target machine.

Earlier versions of GoSerpent have been in use since at least 2021 , operating against victims in Southeast Asia with a simpler design that accepted command-line arguments in plain text. The version disclosed Thursday encrypts those arguments using AES-CBC, with traffic to the command-and-control server protected by the ChaCha20 stream cipher — the same cipher used in TLS 1.3 and the WireGuard VPN protocol, making the encrypted C2 traffic difficult to distinguish from legitimate HTTPS connections at the network level. The SHA-256 hash of a communication password serves as the ChaCha20 encryption key.

Once stable on a target, GoSerpent supports a full suite of remote commands: establishing reverse shells, uploading and downloading files, opening SOCKS5 proxy tunnels, and forwarding traffic through compromised hosts to obscure the attackers' true origin. It disguises itself using filenames that mimic legitimate Windows processes — lass.exe and updates.exe among them — and routes C2 traffic through infrastructure hosted on Alibaba Cloud and UCLOUD HK, both Chinese cloud providers whose domain names security teams typically allow without scrutiny. GoSerpent uses the domain names and as internal secret key strings; Stowaway, deployed in the second phase, uses github.code — all chosen to blend with traffic patterns that security teams habitually trust.

A simpler companion tool, McMx RAT — a Go-based proxy and remote access tool that reads its configuration from plain-text files rather than encrypted arguments — ran alongside GoSerpent throughout the campaign, suggesting the threat actor maintained parallel infection strains simultaneously.

After deploying GoSerpent, the attackers typically waited several days before pushing additional payloads — a deliberate delay intended to outlast the short log retention windows common in many government security operations centers.

The first follow-on tool was ThumbcacheService , a malicious Windows DLL registered as a system service. Its name and the file it creates — thumbcache_605a.db stored in C:UsersPublic — mimic the legitimate Windows thumbnail cache system well enough to evade casual inspection. ThumbcacheService hunted specifically for files with extensions .doc , .docx , .pdf , .xls , and .xlsx — the formats used for official correspondence, reports, and spreadsheets in government environments. Collected files were compressed using 7-Zip with the hardcoded password @vx0a9n5W2M0c3D6.# and a 20MB size ceiling per archive. The service also monitored the Windows Recycle Bin, catching sensitive files that users attempted to delete.

While ThumbcacheService silently built up its document archive, the attackers deployed two credential-dumping utilities. Mimikatz extracted cached credentials and Kerberos tickets from the Windows LSASS process — the same tool used in virtually every major nation-state intrusion campaign of the past decade. QuarksDumpLocalHash pulled local account password hashes from the SAM registry for offline cracking. These stolen credentials were not immediately used. They were stockpiled.

After allowing ThumbcacheService weeks to accumulate files, the attackers returned in May 2026 with a second set of tools. The centerpiece was Stowaway , a customized build of an open-source Go proxy framework. Stowaway communicated over TCP, HTTP, or WebSocket channels, with traffic encrypted using AES-256-GCM or TLS. Via Stowaway, the attackers delivered the final component: a two-part loader called TmcLoader/TmcPayload .

TmcLoader is a C++ service that embeds an encrypted payload in its .data section, decrypts it at runtime, and injects it into the memory space of the legitimate Windows svchost.exe process — a classic living-off-the-land technique. The loader resolves Windows API calls dynamically through a circular XOR encryption scheme (each byte XORed with the value of the subsequent byte) combined with Base64 encoding to conceal the API names from static analysis. It creates a unique system event to prevent multiple infections on the same machine — a detail that indicates careful engineering rather than opportunistic deployment.

The injected component, TmcPayload, reads an encrypted configuration file placed on the victim machine. That configuration file contains the network credentials stolen months earlier by Mimikatz and QuarksDumpLocalHash, along with destination paths for exfiltration. TmcPayload then copies the thumbcache_605a.db archive — the weeks-long accumulation of government documents — out through those authenticated network paths.

The result: the final exfiltration generated no unusual outbound traffic alerts, no suspicious authentication events, and no external connection flags. The data left through internal network shares using credentials that the victim environment recognized as legitimate. This specific architectural choice — harvesting credentials in Phase 1 precisely to make Phase 2 look like authorized access — is the feature that defines this campaign as a planned intelligence operation rather than opportunistic intrusion.

The data categories in scope reflect a classic national-level intelligence collection mandate : police complaint management systems, biometric databases, criminal case files, hotel and tenant records tied to national identity registries, and diplomatic entity networks. Taken together, this data profile enables a foreign intelligence service to map individuals, track movement patterns, identify dissidents, flag potential intelligence assets, and monitor communications between diplomatic entities.

Biometric data is a particularly significant target category: unlike passwords, biometric templates cannot be revoked. A stolen fingerprint or facial recognition record creates permanent intelligence leverage over every individual enrolled in the compromised database.

Kaspersky has not named the specific countries targeted, a standard operational decision in threat intelligence disclosures made before victim-nation notification is complete.

Kaspersky has stopped short of firm attribution. GReAT researchers assess a probable link to TetrisPhantom — a threat actor first disclosed by Kaspersky in 2023 , when the group was found compromising hardware-encrypted USB drives used by APAC government entities to transfer files in sensitive environments. The probable link rests on overlapping victim profiles, technical capabilities, and operational methods between the two campaigns, including a documented TetrisPhantom interest in entities connected to the China-Pakistan Economic Corridor — a Belt and Road project whose regional footprint overlaps with Southeast Asia.

Kaspersky notes that further investigation is required before that association can be confirmed. No national attribution has been made.

Kaspersky published a full set of indicators of compromise alongside the Thursday disclosure, including file hashes for GoSerpent, McMx, ThumbcacheService, Stowaway, and TmcLoader, as well as 11 C2 IP addresses currently associated with the campaign.

Defenders in Southeast Asian government and diplomatic networks should treat the following as immediate priorities:

Check C:UsersPublic for any file named thumbcache_605a.db or similarly named archive files with unusual password protection. This file, which the campaign uses to store harvested documents while awaiting exfiltration, should not exist in that directory under normal Windows operations.

Audit Windows service registrations for DLLs recently added as services, particularly any referencing names that mimic system components. ThumbcacheService disguises itself precisely in this way.

Monitor outbound traffic from svchost.exe processes for connections to the 11 published C2 IP addresses, all of which are currently associated with Alibaba Cloud or UCLOUD HK infrastructure blocks.

Block or flag credential-dumping behavior from Mimikatz (LSASS memory reads) and SAM registry access consistent with QuarksDumpLocalHash. Endpoint detection and response (EDR) tools with behavioral rules for LSASS access should already flag this, but Kaspersky notes the campaign typically waits days between initial access and credential-dumper deployment — meaning alerts from initial compromise may have already aged out of some log retention windows.

The GoSerpent disclosure arrives as Southeast Asian government networks face intensifying attention from state-linked threat actors. The past year has seen Kaspersky's GReAT and other threat intelligence teams document campaigns attributed to OceanLotus (APT32), HoneyMyte (which recently evolved to include a kernel-mode rootkit), ToddyCat (targeting email infrastructure since at least 2020), and Mysterious Elephant. Many of the governments in the region are simultaneously undergoing rapid digital transformation of public services — including precisely the identity, law-enforcement, and diplomatic systems GoSerpent was built to target.

GoSerpent illustrates a broader pattern in the regional threat landscape documented by Kaspersky : more than 3 million backdoor attack detections across Southeast Asian businesses in 2025 alone, with Malaysia recording an 86% year-over-year increase and Indonesia and Vietnam accounting for the largest raw detection volumes.

The full technical report, including MITRE ATT&CK technique mappings and the complete IoC table, is available on Securelist .

GoSerpent is a Go-based remote access Trojan (RAT) that has been active in Southeast Asian government networks since at least 2021. Its targets include police complaint management systems, biometric databases, criminal case files, hotel and tenant records linked to national identity registries, and diplomatic networks. Kaspersky GReAT disclosed the campaign on Thursday, July 16, 2026. The specific countries targeted have not been publicly named by Kaspersky, which is standard practice during active victim notification.

This is the campaign's most significant operational feature. In Phase 1 (which ran for weeks or months), the attackers used Mimikatz and QuarksDumpLocalHash to steal network credentials from compromised systems and stored the collected documents in a disguised archive file. In Phase 2, the TmcPayload component read those credentials from an encrypted configuration file and used them to transfer the archive through internal network paths. Because the transfer used legitimate credentials to access legitimate file locations , it generated no unusual authentication events and no external connection flags — the activity was indistinguishable from an authorized employee copying files.

TetrisPhantom is a threat actor first documented by Kaspersky GReAT in Q3 2023 , when the group was found compromising hardware-encrypted USB drives used by APAC government entities to securely transfer files. The group demonstrated interest in targets connected to the China-Pakistan Economic Corridor and other Southeast Asian strategic contexts. Kaspersky assesses a probable link between TetrisPhantom and the GoSerpent campaign based on overlapping victim profiles, technical capabilities, and operational methods — but has not confirmed the connection. No nation-state attribution has been made.

Kaspersky published 11 specific C2 IP addresses and file hashes for every tool in the GoSerpent chain. Immediate actions: C:UsersPublic for any file named thumbcache_605a.db or similarly unusual archive files with password protection; audit Windows service registrations for recently added DLLs mimicking system component names; monitor svchost.exe for outbound connections to the published C2 IP ranges; and configure EDR rules to flag LSASS memory reads and SAM registry access consistent with Mimikatz and QuarksDumpLocalHash behavior. The full IoC table is published at Securelist .